SSL renegotiate denied

[todd_dsm]

I have a monitor plugged in that does nothing but watch logs. This one is /opt/zimbra/log/mailbox.log. Every now and again I see something new. This is the concern of the day:

2010-03-26 23:45:25,175 WARN [btpool0-16] [] log - SSL renegotiate denied: java.nio.channels.SocketChannel[connected local=/10.0.0.14:443 remote=/10.0.0.14:40639]

My port is open:

# iptables -L
...
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http

Can someone shed some light on the 'denied' part and if so, what's the cure?

Thanks in advance,
todd_dsm

Don't forget to Vote for this bug:
RFE: A place To Display the contents of 'My Documents'
Reasoning: It's new, bold, and cool.

[erik.schwalbe]

We have the same problem here.

log - SSL renegotiate denied: java.nio.channels.SocketChannel

After that, Pop3 doesn't work. Only after restarting Zimbra Server Pop3 work again.

Regards,
Erik

[phoenix]

Originally Posted by erik.schwalbe

We have the same problem here.

log - SSL renegotiate denied: java.nio.channels.SocketChannel

After that, Pop3 doesn't work. Only after restarting Zimbra Server Pop3 work again.

Regards,
Erik

You haven't posted enough information from the log file to determine what the problem is, one line out of context is never sufficient.

[erik.schwalbe]

I think, this exeption show, what the problem is:

2010-08-06 09:23:14,238 INFO  [Pop3SSLServer-2] [ip=92.202.99.174;] ProtocolHandler - Exception occurred while handling connection
java.net.SocketException: Socket closed
        at java.net.SocketInputStream.socketRead0(Native Method)
        at java.net.SocketInputStream.read(SocketInputStream.java:129)
        at com.sun.net.ssl.internal.ssl.InputRecord.readFully(InputRecord.java:293)
        at com.sun.net.ssl.internal.ssl.InputRecord.read(InputRecord.java:331)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:789)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1112)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1139)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1123)
        at com.zimbra.cs.tcpserver.ProtocolHandler.startHandshake(ProtocolHandler.java:184)
        at com.zimbra.cs.tcpserver.ProtocolHandler.run(ProtocolHandler.java:134)
        at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(Unknown Source)
        at java.lang.Thread.run(Thread.java:619)

Regards,
Erik

[phoenix]

Please update your forum profile with the output of the following command (do not post the output in this thread):

zmcontrol -v

What client is being used to connect to the POP3 Zimbra server? Does this problem always occur for POP3 connections once this error appears? Does the problem happen for all POP3 users or just some users? Are the users able to connect with a different POP3 client after this error appears or do they still get the error? What errors (messages) do the users see in their POP3 client? I'm assuming this is for POP3S, is that correct? Do you have any firewall or SElinux active this Zimbra server? Are these users connecting to the Zimbra server via a LAN or from an external IP?

[erik.schwalbe]

What client is being used to connect to the POP3 Zimbra server?

Thunderbird and AppleMail

 [btpool0-1959] [aname=user@domain.com;ip=XX.XXX.XXX.XX;ua=DAVKit/4.0.3 (732);; CalendarStore/4.0.3 (991);; iCal/4.0.3 (1388);; Mac OS X/10.6.4 (10F569);] log - SSL renegotiate denied: java.nio.channels.SocketChannel[connected local=/192.168.0.9:443 remote=/XX.XXX.XXX.XX:52525]

Does this problem always occur for POP3 connections once this error appears?

Yes

Does the problem happen for all POP3 users or just some users?

All users

Are the users able to connect with a different POP3 client after this error appears or do they still get the error?

No, still get the error

I'm assuming this is for POP3S, is that correct?

Yes

Do you have any firewall or SElinux active this Zimbra server?

SELinux and ipTables are disabled

Are these users connecting to the Zimbra server via a LAN or from an external IP?

Both

We only have 3-4 pop3 users. All other users use imap or the zimbra outlook connector with no problems. In former times pop3SSL work and I think after upgrading to Version 6 we have the problems. After restart the zimbra server zmcontrol restart the user can connect to zimbra server with Pop3SSL. After unascertained time the connection is lost.

Regards,
Erik

[phoenix]

OK thanks for those detailed answers, I think you're going to have to file a support case and/or bug report for that to be looked at.

[det]

Originally Posted by phoenix

OK thanks for those detailed answers, I think you're going to have to file a support case and/or bug report for that to be looked at.

Has a case been submitted on this? same issue encountered here. Zimbra Network Ed 6.0.7 on Ubuntu 8.04 64 bit. It has been running fine for over a month then issue came up all of a sudden. A restart of the zimbra service enable POP3S again. IMAPS has no issue.

[joho]

We started seeing this problem yesterday, and it's - as far as we know - the first time. We went from 6.0.7 to 6.0.9; we noticed slow account access yesterday, and the problem peaked this morning. After a zmmailboxdctl restart, it seems to have improved (this solution is obviously unacceptable).


-joho

[aseco]

Any solution found for this error ?